MCP server

Ask ScaleBop about your deployments from inside Claude Code, Cursor, Windsurf, VS Code, or any MCP client that supports remote Streamable HTTP with a bearer header.

Create an API key

Open your ScaleBop account settings (/account).
Under Use ScaleBop from your AI tool, choose Create key.
Tick the projects the key can reach.
Copy the key. It is shown once, together with the .mcp.json and Cursor snippets below, already filled in.

Keys are read-only unless you tick a write scope. The key starts with sbd_live_. Store it in your MCP client or a secure secret manager. You can revoke it at any time.

Scopes: deploy:read (all read tools), deploy:ship (Ship, Redeploy, Roll back, Update setup) and deploy:config (set and delete environment variables and secret references).

Tools that support OAuth connect without a key:

Point the tool at https://api.scalebop.com/mcp.
The tool opens the ScaleBop sign-in and consent screen.
After consent, the connection appears in account settings → MCP connections under the tool’s name, read-only and with no projects. Until you pick at least one, the tool gets a message pointing you there. Choose the projects it may reach and the scopes it carries, then ask your agent again.
Change or revoke the connection any time from the same page. Revoking ends access immediately; a reconnect starts a new, empty grant.

Configure your MCP client

The server URL is https://api.scalebop.com/mcp (replace with your team’s API URL if you self-host). Use Bearer auth with your key.

Claude Code

Create or edit ~/.mcp.json:

{
  "mcpServers": {
    "scalebop": {
      "type": "http",
      "url": "https://api.scalebop.com/mcp",
      "headers": {
        "Authorization": "Bearer sbd_live_..."
      }
    }
  }
}

Cursor

Open Cursor Settings → MCP → Add new MCP server:

Name: ScaleBop
Type: HTTP
URL: https://api.scalebop.com/mcp
Headers: Authorization: Bearer sbd_live_...

If Cursor opens a ScaleBop sign-in window instead of using the key, finish that sign-in. Then open account settings → MCP connections and choose the projects that connection may reach. Cursor starts OAuth when a server advertises it, even when a header is configured.

Windsurf

Add to your Windsurf MCP configuration (mcp_config.json):

{
  "mcpServers": {
    "scalebop": {
      "serverUrl": "https://api.scalebop.com/mcp",
      "headers": {
        "Authorization": "Bearer sbd_live_..."
      }
    }
  }
}

VS Code

Add a server to your MCP configuration (.vscode/mcp.json or the user MCP file):

{
  "servers": {
    "scalebop": {
      "type": "http",
      "url": "https://api.scalebop.com/mcp",
      "headers": {
        "Authorization": "Bearer sbd_live_..."
      }
    }
  }
}

Lovable

In a project, open Connectors and add a custom MCP server:

URL: https://api.scalebop.com/mcp
Authentication: Bearer token or API key
Token: sbd_live_...

OAuth works too: choose it, sign in, then pick projects under MCP connections in ScaleBop.

Bolt

From the chat box, open + → Connectors → Manage connectors → Custom MCP server:

URL: https://api.scalebop.com/mcp
Transport: HTTP
Authentication: API key, and paste sbd_live_...

MCP OAuth is the other option. After you sign in, choose projects under MCP connections in ScaleBop. Bolt does not run local stdio servers.

Available tools

Read tools are free on every plan.

list_projects — projects this key can access.
get_readiness — is the project ready to deploy, and what is missing?
get_deploy_status — latest attempt, live URL, and health.
get_last_failure — error code, reason, redacted log excerpt, and a fix prompt.
get_setup_drift — has the repo drifted from the generated setup?
get_env_vars — keys, classification, scope, secret references, and deployment status. Secret values are never returned.

Action tools

On a paid plan, a key with a write scope can also act for you:

ship (deploy:ship) — moves production to your default branch head; GitHub Actions deploys it.
redeploy (deploy:ship) — re-runs the deploy workflow for what production already has.
update_setup (deploy:ship) — re-analyses and regenerates the setup after drift, delivered as a pull request.
set_env_var / delete_env_var (deploy:config) — set or remove environment variables and secret references.
rollback (deploy:ship) — runs an earlier healthy version again on today’s infrastructure. Pass attemptId for a specific deploy, or leave it out to go back to the newest healthy version that isn’t running. Auto-ship pauses. See Roll back a deploy.

Action tools never act on the first call. Each first call returns a summary (for Ship: the commit, changes since the last ship, and drift status; for env changes: the key, its classification and which deployables change) plus a single-use confirmToken valid for five minutes, bound to that exact request. The tool description tells your agent to show you the summary and wait for your approval; call the tool again with the same arguments plus confirmToken to apply it. Ship keeps every server-side gate the web app has (drift block, launch requirement).

ScaleBop also writes an MCP line into the AGENTS.md / CLAUDE.md section and Cursor rule it manages in your repository, so your agent knows to ask the server. It rides the next regeneration or file restore rather than changing your repo by itself.

Limits

60 calls per minute per key.
2,000 calls per day per account.
get_last_failure is limited to 10 calls per project per hour because it reads GitHub.

Security

Keys are stored only as SHA-256 hashes. ScaleBop never stores the key itself after creation.
Each key and each OAuth connection names the projects it can reach; a leaked credential cannot access your other projects or projects created later.
Keys are read-only by default. Write scopes are opt-in, and every action tool needs a paid plan.
Confirm tokens are single use, expire after five minutes, and are bound to the exact request they summarize — a token from one change cannot confirm another.
Secret values are never returned by any tool, and a secret is set by reference: a tool call that puts a value on a secret is rejected. A secret is a reference to AWS Secrets Manager; the value stays in your AWS account.
Revoke a lost or unused key from account settings. OAuth connections are revoked from the same place and end access immediately.
Changing or deleting an environment variable through a tool emails you. The email names the key and the project. It does not include the value.